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REMARKS 

Applicant has included a Request for Continued Examination to allow the examiner to 
consider references submitted in the enclosed Information Disclosure Statement, discussed 
below. 

Applicant has amended the specification to reference designations and replace them with 
"(not shown)" since the attacking computer and the ISP are not shown nor are they needed to be 
shown in FIG. 1. 

The examiner rejected claims 1-32 under 35 U.S.C. 102(e) as being anticipated by US 
patent application, number 200210035683 Al Kaashoek et al., hereinafter '683. 

The examiner rejected claims 1-32 under 35 U.S.C. 102(e) as being anticipated by U.S. 
200210032774 Al. 

The examiner rejected claims 1-32 under 35 U.S.C. 102(e) as being anticipated by U.S. 
200210032880 Al. 

The specific rejections are set forth in the Examiner's action. 

Claim 1 calls for a monitoring device *** comprising a plurality of probe devices that are 
disposed to collect statistical information on packets that are sent over links that couple the 
network to the data center and a cluster head coupled to each of the plurality of probe devices, 
the cluster head receiving collected statistical information from the probe devices and 
determining from the collected information whether the data center is under a denial of service 
attack. 

In response to Applicant's prior Reply, the examiner contends that: 

Applicant's arguments filed 12/22/04 have been fully considered but they are not 
persuasive. Applicant remarks that the prior arts fail to teach a number of 
features: such as a cluster head, links different network that is being 
monitored/victim center or networks, packets transmitted over links, and 
additionally the previously features of a monitoring device, a plurality of probes 
collecting statistical information from data packets on a network, cluster heads 
coupled to said probes, and determining whether there is a denial of service attack 
on the data center. The examiner does not concur, applicant is reminded that the 
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cluster head to which he is purporting that there is a structural difference has been 
depicted as a black box of figure 3. 

Applicant strongly disagrees. The cluster head depicted in FIG. 3 is described at least in 
FIGS. 3, 5 and 6A-6B. Claim 1 recites the features of the cluster head which Applicant 
considers are needed to distinguish the cluster head over the cited references namely, that the 
cluster head is "coupled to each of the plurality of probe devices" and the cluster head "receiving 
collected statistical information from the probe devices." The cluster head includes "determining 
from the collected information whether the data center is under attack. The probe devices are 
disposed to collect statistical information on packets that are sent over links that couple the 
network to the data center. 

Accordingly, not only is a structural difference present in the cluster head, as described, 
but other structural differences are provided by the arrangement of the probes and so forth as 
recited in the claim 1. 

It is clear that these features are not shown in the publications and that these features are 
claimed structural differences. The publications describe a gateway and data collectors. The 
gateway and data collectors however do not have the features of a plurality of probe devices 
disposed to collect statistical information on packets sent over links that couple the network to 
the data center and a cluster head coupled to each of the plurality of probe devices. In the 
publications, the data collectors are coupled via a redundant network, to a central control center. 

Therefore, the publications neither describe nor suggest the invention of claim 1, at least 
for the reasons that the publications do not suggest a plurality of probe devices disposed to 
collect statistical information on packets sent over links that couple the network to the data 
center and a cluster head coupled to each of the plurality of probe devices 

Claim 3 

Instant claim 3 recites that the cluster head further includes a communication process that 
communicates statistics collected in the probe devices with a control center. The control center 
is distinct from the cluster head in the instant claims and application and that of the publications. 
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Therefore, the publications neither describe nor suggest the invention of claim 3, at least 
for the reasons that, the publications do not suggest a plurality of probe devices disposed to 
collect statistical information on packets sent over links that couple the network to the data 
center and a cluster head coupled to each of the plurality of probe devices and that the cluster 
head further includes a communication process that communicates statistics collected in the 
probe devices with a control center. 

A pplicant's comments on the examiner's remarks 

In the examiner's remarks, the examiner also stated that: 

The aspects of a redundant network is also taught in the prior art, see your remarks 
on page 9, regarding the publications and its functionality. 

In the references, the "redundant network" is taught to connect the gateways and data 
collectors to the control center. In contrast, the cluster head in the instant case, not the probes, is 
connected to the control center by the redundant network. 

In the examiner's remarks, the examiner also stated that: 

Likewise, the probes being disposed to collect statistical information, is precisely the 
function that probes perform on data packets. 

In this observation, the examiner fails to give patentable weight to all of the limitations in 
the claims. Specifically, the examiner fails to show where the references teach the structural 
limitation of the probes monitoring the links between the data center and the network. 

In the examiner's remarks, the examiner also stated that: 

The examiner would like to indicate that the two networks in which the inventions 
are to be used, '974 and the prior art are structurally the identical. 

To the extent Applicant understands this comment with respect to certain of Applicant's 
claims, e.g., claims 8 and 9, in the instant case there are 3 networks, the network being 
monitored, the network on which the probes and cluster communicate, and the network that the 
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cluster head and control center communicate. The references do not show this arrangement. For 
the claims reciting two networks, e.g., claim 2 there is network being monitored (which is 
disclosed in both references) and a dedicated, private network that is a different network from the 
network being monitored (which is disclosed in the instant case but not the references, since in 
the instant case the private network couples the cluster head to the plurality of probe devices). 
Accordingly, the claims are allowable over the references. 

The examiner provisionally rejected claims 1, 4, 8-10, 13, and 16, under 35 U.S.C. 101 as 
claiming the same invention as that of claims 1, 3-4, 6-8, 12-15, 17,and 26-27 of co-pending 
Application No. US 200210035683 Al, hereinafter '683. 

This is a provisional double patenting rejection since the conflicting claims have not 
in fact been patented. 

This rejection is improper since the claims are not identical nor do the claims share the 
same wording. 

In the alternative, the examiner provisionally rejected claims 1, 4, 8-10, 13, and 16, under 
the judicially created doctrine of obviousness-type double patenting as being unpatentable over 
claims 1, 3-4, 6-8, 12-15, 17, and 26-27 of co-pending Application No. US 200210035683 Al, 
hereinafter '683. The examiner stated: 

Although the conflicting claims are not identical, they are not patentably 
distinct from each other because, the monitoring devices and/or probe or plurality 
of probes devices are monitors that are statistical collectors in both applications. 
Similarly, the cluster heads are in fact the controllers/centers for the monitor/probes 
in both applications. It would have been obvious to one of ordinary skill in the art at 
the time of the invention to modify the invention of US application '683, by labeling 
the cluster heads as controllers/centers, and the probe devices/monitors as statistical 
collectors/monitors as recited in the disclosure. One of ordinary skill in the art 
would have been motivated to perform such a modification because it involves only 
the aspect of labeling the functions of the device and not modifying its structure. 
One of ordinary skill in the art would have seen this as an obvious expedient to 
renaming the function of the device/apparatus/system, while retaining the original 
functions. 



The examiner seems to contend that the only distinction between the claims of the instant 
case and the claims of the '683 application is a "labeling" convention. This is in error. The 
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examiner fails to show where the structural differences pointed out by Applicant are found in the 
claims of '683 application. Where a patent to issue on the claims of this application, it would not 
preclude one from practicing the invention, as in the claims of the ' 683 application. This 
conclusion follows because the monitoring devices in the claims of '683 are disposed at a 
plurality of points in the network, whereas "the plurality of probes devices" are disposed to 
monitor links from the network to the data center. While both devices may be monitors, "that 
are statistical collectors in both applications," is immaterial, since the probes and the monitors 
are arranged in different manners and perform different purposes in the '683 and instant case. 
Similarly, "the cluster heads" of the present case are not "controllers/centers for the 
monitor/probes in both applications." The cluster heads interface with the probes and the control 
center (Claim 3) in the instant case, whereas in '683 application the control center is coupled to 
the monitors that are disposed in the network. 

The examiner concludes that "It would have been obvious to one of ordinary skill in the 
art at the time of the invention to modify the invention of US application '683, by labeling the 
cluster heads as controllers/centers, and the probe devices/monitors as statistical 
collectors/monitors as recited in the disclosure." The motivation offered by the examiner is 
"because it involves only the aspect of labeling the functions of the device and not modifying its 
structure." 

Again, the examiner fails to address the aspects of the connections of the probes and the 
cluster head with each other and with links in the arrangement of claim 1 . The distinctions 
between claims of the instant case and the '683 application are not mere labels. The examiner 
improperly equates the "gateway/control center" teachings of the '683 application to 
"probe/clusterhead" teachings of the instant case, despite the structural differences as recited in 
the claims where the '683 application has "monitors disposed at a plurality of points in the 
network," while the instant is local on a set of links into a datacenter. 

Applicant has enclosed an Information Disclosure Statement. Applicant contends that the 
claims are allowable over the art in the IDS and the art of record. Accordingly, allowance of the 
application is requested. 
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